48 C.F.R. § 1503.1003 – Requirements.

(a) A contractor's system of management controls should provide for:
1. (1) A written code of business ethics and conduct and an ethics training program for all employees;
2. (2) Periodic reviews of company business practices, procedures, policies and internal controls for compliance with standards of conduct and the special requirements of Government contracting;
3. (3) A mechanism, such as a hotline, by which employees may report suspected instances of improper conduct, and instructions that encourage employees to make such reports;
4. (4) Internal and/or external audits, as appropriate;
5. (5) Disciplinary action for improper conduct;
6. (6) Timely reporting to appropriate Government officials of any suspected or possible violation of law in connection with Government contracts or any other irregularities in connection with such contracts; and
7. (7) Full cooperation with any Government agencies responsible for either investigation or corrective actions.
(b) Contractors who are awarded an EPA contract of $1 million or more must display EPA Office of Inspector General Hotline Posters unless the contractor has established an internal reporting mechanism and program as described in paragraph (a) of this section.